feat: consolidate database management work

Add catalog-owned logical relationships and runtime snapshots, extend the database-management UI and validation coverage, and document the updated operational workflow.

Keep active sensitive-generation status in a tooltip and indicator, and update the layout E2E to follow the history action in its new database-scoped location.

frontend/src/shell/AppShell.new-session.test.tsx

@@ -156,6 +156,11 @@ test("model selector shows the three Pi-enabled models and stores the selected p
 });
 
 test("opens Workspace management from the right sidebar without interrupting the shell", async () => {
+  setAuthState({
+    issuer: "test", subject: "admin", roles: ["admin"],
+    permissions: ["session.use", "workspace.manage", "workspace.secrets.manage", "database.manage", "pi.manage"],
+    isAdmin: true, csrfToken: null, session: null,
+  });
   server.use(
     http.get("/api/workspace-registry/status", () =>
       HttpResponse.json({ branch: "main", ahead: 0, behind: 0, degraded: false })),
@@ -163,15 +168,31 @@ test("opens Workspace management from the right sidebar without interrupting the
   );
   renderShell();
 
+  await userEvent.click(screen.getByRole("button", { name: "Administration" }));
   await userEvent.click(screen.getByRole("button", { name: "Workspace management" }));
 
   expect(await screen.findByRole("heading", { name: "Workspace management" })).toBeVisible();
   const dialog = screen.getByRole("dialog", { name: "Workspace management" });
   const workArea = screen.getByTestId("conversation-column");
   const sessionNavigation = screen.getByRole("complementary", { name: "Session navigation" });
+  const workspaceManagement = within(sessionNavigation).getByRole("button", { name: "Workspace management" });
+  const newSession = within(sessionNavigation).getByRole("button", { name: "New session" });
   expect(workArea).toContainElement(dialog);
   expect(sessionNavigation).not.toContainElement(dialog);
   expect(screen.getByTestId("app-shell")).toHaveAttribute("data-activity-layout", "closed");
+  expect(workspaceManagement).toHaveAttribute("aria-current", "page");
+  expect(workspaceManagement).toHaveAttribute("aria-expanded", "true");
+  expect(workspaceManagement).toHaveAttribute("data-navigation-state", "current");
+  expect(workspaceManagement).toHaveClass("bg-[oklch(var(--nav-active))]");
+  expect(newSession).toHaveAttribute("data-navigation-state", "available");
+  expect(newSession).not.toHaveAttribute("aria-current");
+
+  await userEvent.click(screen.getByRole("button", { name: "Close workspace management" }));
+  await waitFor(() => expect(screen.queryByRole("dialog", { name: "Workspace management" })).not.toBeInTheDocument());
+  expect(newSession).toHaveAttribute("aria-current", "page");
+  expect(newSession).toHaveAttribute("data-navigation-state", "current");
+  expect(workspaceManagement).toHaveAttribute("aria-expanded", "false");
+  expect(workspaceManagement).toHaveAttribute("data-navigation-state", "available");
 });
 
 test("does not block the shell when the DWH is unavailable at startup", async () => {
@@ -184,7 +205,8 @@ test("does not block the shell when the DWH is unavailable at startup", async ()
   );
   renderShell();
 
-  expect(await screen.findByRole("button", { name: "Workspace management" })).toBeVisible();
+  expect(await screen.findByRole("button", { name: "New session" })).toBeVisible();
+  expect(screen.queryByRole("button", { name: "Administration" })).not.toBeInTheDocument();
   expect(screen.queryByRole("heading", { name: "Connection unavailable" })).not.toBeInTheDocument();
   expect(healthChecks).toBe(0);
 });